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REMARKS/ARGUMENTS 

Claims 39-56 and 58 - 59 are presented for reconsideration and further examination in view of 
the foregoing amendments and following remarks. Claims 1 - 38 and 57 have been cancelled without 
prejudice or disclaimer to the subject matter contained therein. Applicants do not intend for the subject 
matter of the claims that have been cancelled in this application to be dedicated to the public. 

In the outstanding Office Action, the Examiner indicated that the Information Disclosure 
Statement submitted on February 8, 2007 is not in full compliance with the provisions of 37 CFR § 1 .97; 
rejected claims 39 - 44, 46 - 53, 55, 56, 58 and 59 under 35 U.S.C. § 1 02(e) as being anticipated by U.S. 
Patent No. 7,415,509 to Kaltenmark, et al. (hereinafter referred to as "Kaltenmark et al."); and rejected 
claims 45 and 54 under 35 U.S. C. § 1 03(a) as being unpatentable over Kaltenmark et al. in view of U.S. 
Patent No. 5,790,798 to Beckett, II, et al. (hereinafter referred to as "Beckett"). 

Claims 39 and 48 have been amended in order to define the presently claimed subject matter in a 
clearer way without prejudice or disclaimer to the content therein. It is respectfully submitted that the 
above amendments do not introduce any new matter to this application within the meaning of 35 U.S.C. 
§132. 

Information Disclosure Statement 

The Examiner indicated that the Information Disclosure Statement submitted on February 8, 
2007 is not in full compliance with the provisions of 37 CFR §1 .97 since copies of the foreign 
references were allegedly not submitted. Applicants aver that copies of the foreign references were 
submitted on February 8, 200 as noted on the transmittal letter of the same date. Nonetheless, copies 
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of all foreign references are provided herewith with a supplemental Information Disclosure 
Statement. 

Prior Art Rejections 

The Examiner rejected claims 39 - 44, 46 - 53, 55, 56, 58 and 59 under 35 U.S.C. § 102(e) as 
being anticipated by Kaltenmark et al. Applicants respectfully traverse the prior art rejections since all 
of the features of the presently claimed subject matter are not disclosed, taught or suggested by the cited 
prior art. For a reference to anticipate an invention, all of the elements of that invention must be present 
in the reference. The test for anticipation under section 102 is whether each and every element as set 
forth in the claim is found, either expressly or inherently, in a single prior art reference. Impax 
Laboratories Aventis v. Pharmaceuticals, 468 F.3d 1366, 1381 (Fed. Cir. 2006). 

Independent claim 39 recites "[a]n apparatus configured to monitor and audit activity in a 
network, the network utilizes an incremental protocol, the apparatus comprising: an analyzer being 
configured to analyze intercepted packets, wherein said packets are conveyed by entities in the network, 
and being configured to generate analyzed data based on information associated with at least some of 
said packets, the analyzed data being indicative of sessions and being indicative of an incremental screen 
protocol used in each of said sessions; a mirror manager being responsive to said analyzed data for 
generating mirror data representative of mirror sessions, each mirror session corresponding to one of said 
sessions; and an audit event analyzer being responsive to said mirror data, said audit event analyzer 
being configured to generate event data representative of inbound audit events and outbound audit 
events, said event data including characteristics relating to at least on-screen field location of data being 
part of the inbound audit events and outbound audit events, said at least on-screen field location being 
representative of at least one operation performed in the network, said audit event analyzer being adapted 
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to analyze said event data for extracting extracted data from event data representative of an inbound 
audit event together with the characteristics respective of said inbound audit event, and to generate event 
data representative of a united audit event by combining the extracted data with one or more fields in 
event data representative of an outbound audit event based on said characteristics. 

According to the presently claimed subject matter, the audit event analyzer is configured to 
generate event data "including characteristics relating to at least on-screen field location of data being 
part of the inbound audit events and outbound audit events." Support is provided, for example, by the 
present patent application on page 21, lines 16-22, teaching that "Data representative of a screen 
includes, for example, fields to be displayed on the terminal their respective attributes additional 
characteristics (such as position on the screen. ..." Further support is provided, e.g., by Figures 6A, 6B, 
6C and 6D, wherein the description teaches that "Fig. 6C illustrates ... data representative of the 
outbound audit event of Fig. 6A. Inthe figure ... every occurrence of " 1 1 xx yy" means that the position 
of the field is calculated based on xx andyy For example, 11 40 40 means position row 1 column 1 on 
the screen. Every occurrence of "Id zz " means a new field in this location and its attributes described 
by zz" (see the present patent application, page 24, lines 1-7). Then, "Fig. 6D illustrates ... data 
representative of the inbound audit event including data illustrated in Fig. 6B. ... In this example, ... 
"C6 7B " is the cursor position; and the rest are instructions to put specific data representative of part of 
the screen in specific locations. " (see the present patent application, page 24, lines 10-15). The present 
patent application on page 28, line 29, to page 29, line 2, teaches that "a new audit event is generated 
combining data representative of the outbound audit event and data representative of information 
inserted in the inbound audit event. This newly generated audit event constitutes a united audit event". 
Indeed, "Fig. 6E illustrates ... data representative of the united audit of Fig. 6B. It should be appreciated 
that 6E01 is similar to 6C01, but include the data of 6D01 " (the present patent application, page 24, lines 

8 



Appl. No. 10/585,452 

Reply to Office Action of January 12, 2009 
Attorney Docket No. 275 12U 

16-18). In addition, "extracting extracted data from event data representative of an inbound audit event 
is supported, e.g., by the present patent application, page 27, lines 7- 1 0, teaching that "... it is required to 
analyze the audit event; extract conveyed information therefrom...." 

In order to help exemplify the difference from the cited prior art publications, an example is 
provided in the Appendix of this paper. DRAWING 1 of the example describes contents of a first 
screen displayed on a terminal of a user who displays stocks' information (Flash Quotes) for the symbol 
TGYS. The illustrated screen allows the user to feed a command in order to interact with the 
application. In this case, the user can feed his command in one of two fields, one in the upper left part of 
the screen and the other in the bottom of the screen, both appearing on-screen as following the word 
"Command:". Hereinafter, throughout the present example, these fields are referred to, respectively, as 
the "upper command field" and "lower command field." It is noted that the data displayed on the user's 
screen is represented by event data respective of an outbound audit event. 

DRAWING 2 illustrates the event data respective of the outbound audit event in 3270 (which is 
a legacy protocol). The specification of the present application explains (e.g. on page 24, lines 4-5) that 
"11 xx yy" means that the position of the field is calculated based on xx andyy. Accordingly, in the 
outbound event illustrated in DRAWING 2, the position of the cursor while starting to draw the screen 
on the user's terminal is set to "77 40 40", which is row 1 column 1. Then, the screen is drawn 
continuously, including "29 02 CO 40 42 F4" which represents an alphanumeric input field (the upper 
command field) 1 . Then the screen is further drawn, including the Symbol, Last Sale etc, and the 
"Command:" and the lower command field. Then, the cursor is positioned in the upper command field 

1 The number 29 means that this is the beginning of a field with special characteristics. 02 means that 
there are 2 characteristics of the field: CO means that the next characteristic is one of the field's attributes. 
40 is the characteristic specifying that the field is alpha numeric and unprotected (i.e. input field), 42 
means that the second characteristic of the field is the color, while F4 means Green. 
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(as represented by "77 CI 6C"). Hence, 77 CI 6C represents the position of the cursor immediately after 
the screen is drawn. 

During trade a stock's value can change. Hence, in order to display updated information, the user 
wants to refresh the screen. Therefore, the user types the command "REFRESH" in the command field. 
DRAWING 3 illustrates the "REFRESH*' command, as fed by the user. It is noted that the user selected 
to feed the command in the upper command field, which in this case is where the cursor is initially 
positioned. 

DRAWING 4 illustrates the event data representative of the inbound event that conveyed the 
command "REFRESH" to the host. The event data includes on-screen field location characteristics: 77 
CI 6C, which is emphasized for convenience. It is possible to calculate the field location in accordance 
with the on-screen field location characteristics. In the example, "77 CI 6C" means "SET BUFFER 
ADDRESS to (CI 6C)", which is equal to "SETBUFFER ADDRESS to 108", when 108 represents the 
1 08 th character on screen. In a terminal having 80 characters per line, " 7 7 CI 6C" means "SET BUFFER 
ADDRESS to (Row 2, Column 28)." It is appreciated that by analyzing the event data represented by 
DRAWING 4 alone, it is possible to draw the word REFRESH in Row 2 column 28 on screen, yet, all 
the other information will be missing. DRAWING 5 illustrates the representation of the information 
included in the inbound event of DRAWING 4 when taken alone. In order to reconstruct the image that 
appeared to the user just after typing REFRESH and before pressing Enter, it is necessary to combine the 
extracted data (i.e., "REFRESH") with one or more fields in event data representative of an outbound 
audit event (i.e., with the upper command field) based on said characteristics (i.e., in Row 2, Column 
28). According to the presently claimed subject matter, the data representative of the united audit even 
obtained further to combining extracted data (i.e., "REFRESH") with one or more fields in event data 
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representative of an outbound audit event, will include the data of DRAWING 2 and the data of 
DRAWING 4, as illustrated by DRAWING 6. 

According to the presently claimed subject matter, it is possible to draw the data representative of 
the united audit event (i.e., DRAWING 6) on screen, thereby generating an image similar to 
DRAWING 3. It is noted that the host that runs the application operated by the user had never had an 
event similar to the data illustrated by DRAWING 6, i.e., data similar to the data represented by 
DRAWING 6 was never generated either by the host (to constitute an outbound audit event) or by the 
terminal (to constitute an inbound audit event). It is generated only in the audit event analyzer, by 
combining the extracted data with one or more fields in event data representative of an outbound audit 
event based on said characteristics. In response to the user's REFRESH command, the screen is 
refreshed to include the updated stock's value. The screen including the updated information is illustrated 
in DRAWING 7, while the event data respective of the outbound event representing this screen is 
illustrated in DRAWING 8. 

It is noted that like the screen of DRAWING 1, the screen of DRAWING 7 also includes an 
upper command field and a lower command field. Please note that here, similarly to DRAWING 2, 
immediately after drawing the screen the cursor is positioned in CI 6C, i.e., in the upper command field. 
Further to displaying the information included in DRAWING 7, the user selects to refresh the screen 
again, this time by feeding the REFRESH command in the lower command field, as illustrated in 
DRAWING 9. In order to do so, the user, who controls the terminal, moves the cursor to the lower 
command field, which is represented by the "29 02 CO 40 42 F4" in DRAWING 8, where he types 
REFRESH and presses Enter in order to convey the command to the host. The event data representative 
of the corresponding inbound event is illustrated in DRAWING 10 that includes 11 4A 4 A, namely, 
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"SET BUFFER ADDRESS to (Row 9 5 Column 10)", which is the lower command field. In order to 
reconstruct the image that appeared to the user just after typing REFRESH and before pressing Enter, it 
is necessary to combine the extracted data (i.e., "REFRESH") with one or more fields in event data 
representative of an outbound audit event (i.e., with the lower command field) based on said 
characteristics (i.e., in 1 1 4A 4A, namely, "SET BUFFER ADDRESS to (Row 9, Column 10)"). It was 
already explained (with reference to DRAWING 2) that the position of the cursor while starting to draw 
DRAWING 7's screen on the user's terminal is set to "77 40 40", which is row 1 column 1 . Therefore, it 
is possible to determine the position in the data of DRAWING 9, where the REFRESH should be 
combined. 

The example described above illustrates that monitoring and auditing using united audit events' 
generation does not depend on the application that the user operates. It is possible to apply the same 
method to any 3270 intercepted communication, or even more generally, to any legacy protocol's 
intercepted communication, without knowledge of the application operated. 

1. Arguments regarding the cited prior art references 

Kaltenmark et al. discloses an operations architecture and method of providing an operations 
architecture for a netcentric computing system that includes a server connected with a client. The client 
may be a remote client or a client that is connected with the network of the netcentric computing system 
through a LAN connection or some other equivalent network connection. Also, according to Kaltenmark 
et. al., the preferred operations architecture includes a remote management tool that allows support 
personnel from the netcentric computing system to take control of the client if required. This allows 
support personnel to diagnose and repair problems with the client if they occur during operation. Further, 
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according to Kaltenmark et. al., a systems monitoring and tuning tool is also provided by the preferred 
operations architecture, said monitoring and tuning tools are capable of monitoring applications, 
middleware, databases, networks, clients and servers, and the tuning tools are capable tuning 
applications and dealing with network capacity issues (col 3, line 5 to col. 4, line 22). However, 
Kaltenmark et. al. does not teach either how to analyze intercepted packets or reconstruct user screens 
(events being related to on-screen field locations). 

In addition, the Applicants respectfully note a typographical error on page 3, lines 12 - 13, of the 
Office Action, wherein it is indicated that the management data is the mirror data. It should be noted that 
the mirror data, according to the presently claimed subject matter, is used for reconstructing user screens 
(events being related to on-screen field locations), and it does not refer to the management data (for 
example, on page 9, lines 10 - 18, of the present patent application it is advised that "...the legacy 
auditor further processes data representative of mirror sessions in order to generate data representative 
of audit events. An audit event is indicative of an operation performed by a user in the legacy system, an 
operation reflected on the user 's screen. Examples of audit events are displaying screens on a terminal 
typing data in data-fields, pressing buttons on a screen or keys on a keyboard...). Thus, Applicants 
respectfully submits that Kaltenmark et. al. does not teach how to maintain the mirror data. 

Beckett et. al. (US 5,790,798) discloses an improved method and apparatus fox providing on-the- 
job work training of an agent or employee, including the provision for passive workstation monitoring 
(col.2, lines 23 - 33). Also, according to Beckett et. al, a method and apparatus for simultaneous 
recording of the on-screen and telephone activities of an employee's workstation is provided to allow the 
remote playback of said activities at a second workstation on a common network (col. 2, lines 34 to 
col.3, line 50; col. 4, lines 20-50). However, Beckett et. al. does not teach or suggest handling and 
maintaining mirror data and/or mirror sessions. 
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Since the combination of Kaltenmark et. al and Beckett et. al. does not disclose, teach or suggest 

either how to analyze intercepted packets and reconstruct user screens (which are events being related to 

on-screen field locations), or how to maintain the mirror data, Applicants believe that the amended set of 

claims is patentable over the prior art. The Applicants respectfully request accepting the above 

amendments and allowing the patent application in the light of the current claim amendments and 

arguments submitted with the response to the outstanding Office Action. Accordingly, Applicants 

respectfully request that the Examiner reconsider and withdraw the claim rejections. 
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CONCLUSION 



In light of the foregoing, Applicants submit that the application is now in condition for 
allowance. If the Examiner believes the application is not in condition for allowance, Applicants 
respectfully request that the Examiner contact the undersigned attorney if it is believed that such contact 
will expedite the prosecution of the application. 

In the event this paper is not timely filed, Applicants petition for an appropriate extension of 
time. Please charge any fee deficiency or credit any overpayment to Deposit Account No. 1 4-01 12. 
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